Analysis
-
max time kernel
38s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-02-2023 05:13
Static task
static1
Behavioral task
behavioral1
Sample
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
Resource
win10v2004-20221111-en
General
-
Target
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
-
Size
517KB
-
MD5
9eb9ce6fa80e866fccb277b400033685
-
SHA1
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8
-
SHA256
d66c034380086e36912b8865f41b0dc3ea540a014ec42579ac9645dca5ae4858
-
SHA512
16bea65d58a3f968110411b067ea7cbdb4cab5ebd1edbf9d94428fed1bc0e40741c799b0c4d6ddd9de3e87f18322416924f03478a6041f8566f64f7bded9e760
-
SSDEEP
12288:Eg8tD+p1h79i/DdVedE5fJD7uwkIPveEosOgGSgSkrcq3qilOL:EgwVDdcE5fJheEovgYSkwq3qis
Malware Config
Extracted
xloader
2.3
ubqx
missingounces.com
lanjay.com
whizbets.com
maltaprefix.icu
vmatranslations.com
nuno-hh.com
dxcsmm.com
maxirnintegrated.com
jpavwa.com
shieldsvalleyrancher.com
chennaimarketplace.store
onlineordersecrets.com
missysluxuryhairbundles.com
olmtopst.info
abcbooch.com
aycarcarrental.com
firsttexassubaru.com
lessstuffmorestory.com
nassausbestroofers.com
j976.net
qixipanda.com
gadgetsdesi.com
theglobalvillageinitiative.com
travelheadrest.com
vwvvw-roblox.com
testweeblyaugust1.website
stringkind.com
fuersz.com
sinnbefreit.com
cced2020.site
naturalove.store
135799.xyz
sultanpalaces.com
logicalsystems-group.com
betocity.net
austinrobotic.com
akademimasirfan.com
selfdevelopservices.com
jdcloud-neucampus.com
bakergirlsocialclub.com
thedomestead.com
rocketspace.agency
komparerio.com
sempredicorsashop.com
fideliescare.com
oohashi-st.net
cheaptowingastoria.com
thehaleale.com
inter-help.net
mylifeisrawsome.com
zhangttz.club
mimik33.info
lovebbhdgujfim.net
welcome2america.net
pimbedc.today
teesmusicschool.com
hanyasesaat.com
pizzapacman.com
deskall.space
baktaryo.com
gabality.net
buykiraana.com
welpconsulting.com
coreinfotechinc.com
joynerpropertyinvestments.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1316-55-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exedescription pid process target process PID 1720 set thread context of 1316 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exepid process 1316 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exepid process 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exedescription pid process target process PID 1720 wrote to memory of 1316 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe PID 1720 wrote to memory of 1316 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe PID 1720 wrote to memory of 1316 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe PID 1720 wrote to memory of 1316 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe PID 1720 wrote to memory of 1316 1720 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe 4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe"C:\Users\Admin\AppData\Local\Temp\4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe"C:\Users\Admin\AppData\Local\Temp\4f6fa448454b581d6c8e7aa6ed3ef72e66062bf8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses